HackingRetail & ConsumerRetailVulnerability ExploitCustomer Data InvolvedIdentity (basic)Financial accountCredentialsLowContained

Backcountry Edge, Inc.

bd_16214674cb5fd42d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 3, 2019

Filed

Jun 27, 2019

To disclose

24 days

Affected

91state residents only

Linked

5 filings

Confidence

66%

Full breach record for Backcountry Edge, Inc. →2 incidents on file

Backcountry Edge, Inc. notified Montana and other states of a cyberattack on its website confirmed on June 3, 2019. Unauthorized access may have exposed customer names, billing/shipping addresses, credit/debit card info, security codes, and usernames/passwords. No evidence of misuse was found. The company provided 12 months of free credit monitoring via TransUnion.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 24 days

Jun 3, 2019

Discovered

Jun 27, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Oregon State AGbd_176660ca3ea77fc82019-07-02 · +5dVerified
Washington State AGbd_54eeaff5ff3f3bdf2019-07-02 · +5dVerified
California State AGbd_911b3c5ff0a6de872019-07-02 · +5dVerified
New Hampshire State AGbd_cf01d34910f199c52019-07-02 · +5dVerified

Name: Backcountry Edge, Inc.
norm: backcountry edge
Domain: backcountryedge.com

Name: Backcountry Edge, Inc.
norm: backcountry edge
Domain: backcountryedge.com
Industry: Retail & Consumerllm

Discovered: Jun 3, 2019
Materiality determined: —
Notification sent: Jul 2, 2019
Affected individuals: 91state-resident count only
Data types: Identity (basic)Financial accountCredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Initial access: exploit_public_facing

During the incident: Providing access to an online credit monitoring service (myTrueIdentity) for twelve (12) months at no charge through TransUnion Interactive
Recommending customers place a fraud alert or security freeze on their credit reports
Recommending customers change online password(s) and security question(s)/answer(s)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Montana State AGJun 27 · first · this page

Oregon State AG+5d

Washington State AG+5d

California State AG+5d

New Hampshire State AG+5d

Pattern: first filing Jun 27 (MT), last Jul 2 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Breach-NotificationDetails-13.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 27, 2019
Raw hash: ed0813b83767ce91de0ec80fc36b7fbc404013055023cbf583b73340c47f736a

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityBackcountry Edge, Inc.

Victim entityBackcountry Edge, Inc.

Incidentdiscovered Jun 3, 2019

Stated responseProviding access to an online credit monitoring service (myTrueIdentity) for twelve (12) months at no charge through TransUnion Interactive

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov